In the August 2022 survey we received responses from 1,135,075,578 sites across 271,740,771 unique domains and 12,365,527 web-facing computers. This reflects a loss of 4.4 million sites, but a gain of 12,212 domains and 24,355 computers.

OpenResty saw the most significant change in web-facing computers, with a gain of 10,138 (6.1%). Furthermore, 2.8 million (3.1%) extra sites were seen since July, with a small loss of 466,322 domains (1.2%). This continues the trend of OpenResty’s fast growth in web-facing computers (46% since August 2021) while the number of domains and sites has not grown in tandem, remaining roughly static over the period.

nginx continues to be the most commonly used web server and saw modest gains of 25,053 domains (0.03%) and 13,481 computers (0.3%). However, we experienced a significant reduction in the number of nginx-hosted sites responding to our requests this month, with a loss of over 15 million. This represents around 4% of sites hosted using nginx in July.

Continuing the trend of strong growth over the past two months, Cloudflare gained an additional 4.4 million sites (6%) and 1.1 million domains (4.7%). This gives Cloudflare a total market share of 6.8% of sites and 9% of domains, an increase of 0.4pp on both metrics since July. Cloudflare also had the strongest growth amongst the top million busiest sites, gaining 0.25pp, thereby holding a 20.51% market share.

Apache’s position as the most commonly used web server for the top million busiest sites continues to erode, with a loss of 0.19pp this month. nginx continues to gain market share, up 0.07pp. If this trend continues, nginx will overtake Apache in the short term, and in the long term, Cloudflare will overtake both of its rivals.

Vendor news

• nginx reaffirmed its commitment to the open source community in this year’s roadmap, with a greater focus on modernising its community management approach and optimising end developer experiences.
• Lighttpd 1.4.66 was released on 7 August 2022, featuring a range of bug fixes.
• Apache Tomcat 8.5.82 was released on 13 August 2022. The majority of changes were minor, however, the release includes a mitigation for an XSS vulnerability in example code distributed with Tomcat (CVE-2022-34305).
• Cloudflare announced the availability of Weighted Pools for its Load Balancer product, which allows for assigning weights to origin servers to distribute requests non-uniformly.
• LiteSpeed Web Server 6.1 RC1 Dev was released on 17 August 2022. This is the latest version in the LSWS 6.1 stream and includes support for triggering reCAPTCHA in its mod_security engine, and several bugfixes.

Continue reading

In the July 2022 survey we received responses from 1,139,467,659 sites across 271,728,559 unique domains and 12,341,172 web-facing computers. This reflects a loss of 7.5 million sites and 1.3 million domains, but a gain of 116,386 computers.

Cloudflare continues its trend of strong growth across the sites and domains metrics this month, increasing by 5.8 million (8.6%) and 259,000 (1.24%), around double that of last month. This gives Cloudflare a total market share of 6.4% share of sites and 8.6% domains, increases of 0.5pp and 0.1pp compared to June.

Whilst still being the most popular vendor across the sites, domains and web-facing computers metric, nginx takes a loss of 4.99 million sites (1.43%), 775,000 domains (1.02%) and 3,400 computers (0.1%) this month. Apache also saw losses, dropping by 1.28 million sites (0.49%) and 379,000 domains (0.61%), however experienced the largest gain in web-facing computers of almost 22,000 (0.6%).

Apache continues to hold on to the top spot in the market share of the top million busiest sites with 22.33%, with nginx in close second at 21.55%. Both however have seen decreases in market share of 0.22pp and 0.1pp respectively, with Cloudflare increasing by 0.08pp to 20.26%. If this trend continues, we should expect to see Cloudflare overtake its rivals within the next year.

OpenResty saw its most significant change over the last 4 months with a decrease of 2.9 million sites (3.21%) and 354,000 domains (0.87%). Conversely, it experienced a significant gain of 17,700 web-facing computers (12.0%).

Lightspeed saw strong growth this month with an increase of 745,000 sites (1.4%), 88,000 domains (1.1%) and 4,500 computers (3.3%).

Vendor News

• nginx 1.23.1 was released on 19 Jul 2022 containing bug fixes, and most notably a memory usage optimization for setups using SSL proxying.
• njs 0.7.6, the scripting language used to extend nginx was also released on 19 Jul 2022, adding various language features and bug fixes.
• Google introduces a preview release of batch on 13 July 2022, a managed service for scheduling batch jobs at scale on the Google Cloud Platform. Batch can manage a job queue, provision and autoscale resources, run jobs, execute subtasks, and deal with common errors automatically.
• Oracle announce the general availability of their Oracle Database Service on Microsoft Azure.
• Cloudflare announces Location-Aware DDoS Protection for Cloudflare Enterprise customers that are subscribed to the Advanced DDoS service. The technology records the typical locations of traffic to a website and uses this as a metric to detect DDoS attacks coming from more unusual and wider spread locations.
• Microsoft warns that attackers are increasingly leveraging Internet Information Services (IIS) extensions as covert backdoors into servers this month, encouraging organisations to follow security practises to help defend their servers.

Continue reading

In the June 2022 survey we received responses from 1,146,976,964 sites across 273,010,403 unique domains and 12,224,786 web-facing computers. This reflects a loss of 8.75 million sites and 583,000 domains, but a gain of 155,000 computers.

Cloudflare experienced strong growth this month, gaining 2.99 million sites and 85,000 domains, representing a 4.64% growth in its number of sites. Cloudflare experienced a significant outage on 21 June, impacting around half of the total requests made to its network. The outage lasted around an hour and a half and affected a significant number of popular sites. 20.2% of the million most visited sites rely on Cloudflare (up 1,400 sites since last month).

The three largest vendors by the million most visited sites metric—Apache, nginx, and Cloudflare—all have similar market share, though only Cloudflare gained market share this month. Apache saw the largest loss, dropping 2,190 sites (-0.96%), while nginx lost 280 sites (-0.13%).

LiteSpeed gained a significant number of sites with an addition of 2.96 million (+5.89%), and gained 171,000 (+2.21%) domains - the second largest increase this month. The number of web-facing computers using LiteSpeed also showed strong growth, increasing by 4,460 (+3.44%) to a total of 134,000.

nginx and Apache remain the two largest server vendors, though both saw similar losses of 6.52 million (-1.84%) and 6.18 million (-2.33%) sites this month. Despite this, nginx gained 795,000 (+1.06%) domains and saw continued growth in the number of web-facing computers with 158,000 (+3.44%) computers. Conversely, Apache lost 1.07 million domains (-1.71%) and 25,700 (-0.74%) web-facing computers.

Vendor news

• Apache httpd 2.4.54 was released on 8 June 2022. This release resolves multiple security issues, including several that affect mod_lua.
• nginx 1.23.0 was released on 21 June 2022. This is the first release in the 1.23.x mainline branch which will include newly developed features and bug fixes. By comparison, the 1.22.x stable branch released last month will only receive major bug fixes from the 1.23 mainline release. The update includes several changes that affect headers in addition to several bug fixes.
• njs 0.7.5 was also released on 21 June alongside nginx 1.23.0. njs is nginx’s JavaScript-based scripting language, and this update includes several small changes affecting headers in addition to bug fixes.
• Lighttpd 1.4.65 was released on 7 June 2022, bringing with it an implementation of WebSockets over HTTP/2. The release also includes an announcement of future scheduled behaviour changes that include using strong, modern TLS cipher suites by default.
• Apple announced support for Private Access Tokens in upcoming releases of iOS and macOS. This is part of the Privacy Pass standard, a collaboration between Apple, Google, and Cloudflare that can replace CAPTCHAs across the web by providing a secure way for the device to attest that it is an authentic device.
• Google Cloud recently added five new regional data centers, taking the total number of available GCP regions to 34. The new regions added were in Columbus, OH, Madrid, Dallas, TX, Milan, and Paris.

Continue reading

In the May 2022 survey we received responses from 1,155,729,496 sites across 273,593,762 unique domains and 12,069,814 web-facing computers. This reflects a loss of 5.23 million sites but a gain of 1.63 million domains and 95,200 computers.

nginx gained the largest number of domains (+1.24 million) and also a hefty amount of web-facing computers (+21,500), further securing its lead in both metrics. The total number of domains powered by nginx is now 75.0 million (+1.68%) and its market share has increased to 27.4% (+0.29). In terms of web-facing computers, nginx now has a total of 4.60 million; and although its leading market share fell slightly to 38.1%, Apache’s fell slightly further, extending the gap between the two to 9.54 percentage points.

nginx also continues to lead with a 30.7% share of all sites, despite losing the largest amount this month (-6.57 million). Apache follows with a share of 23.0%, but also lost a large number of sites (-2.32 million). The largest gain in this metric was seen by Google, which added 2.96 million sites to its total and increased its market share to 4.14%. LiteSpeed made the second largest gain of 1.26 million sites, and stays slightly ahead of Google with a share of 4.35%.

Google and LiteSpeed also made the only significant gains in the active sites metric, with Google gaining 977,000 and LiteSpeed gaining 151,000. Google has a greater lead in this metric, with a market share of 9.49% versus LiteSpeed’s 4.60%.

Cloudflare is continuing to edge its way up towards the leaders in the top million websites. This month it gained an additional 1,822 sites and now accounts for more than 20% of the top million sites for the first time. Meanwhile, both Apache and nginx lost more than a thousand sites each in the top million, making it look ever more likely that Cloudflare could gain places by the end of the year. Apache, nginx and Cloudflare currently have top-million site shares of 22.8%, 21.7% and 20.0% respectively.

One surprise this month was that the largest computer growth was seen not by nginx, but by the awselb (Amazon Web Services Elastic Load Balancing) web server, which gained 26,200 computers to reach a total of 378,000. These computers are likely to form only a small fraction of the AWS infrastructure used by the 1.86 million sites that are served from these computers, as AWS ELB achieves fault tolerance and scalability by automatically distributing incoming application traffic across multiple targets, and can also spread traffic across multiple AWS Availability Zones.

Vendor news

• nginx 1.22.0 was released on 24 May 2022. This is the first release in the 1.22.x stable branch and incorporates new features and bug fixes from the 1.21.x mainline branch. Some of the notable new features include support for OpenSSL 3.0 and the PCRE2 library, as well as some security improvements such as hardening against potential request smuggling and cross-protocol attacks.
• njs 0.7.4 was also released on 24 May 2022. This version of nginx’s JavaScript-based scripting language includes several bug fixes and adds extended directives for configuring the Fetch API.
• Apache Tomcat 9.0.63, 10.0.21 and 10.1.0-M15 (alpha) were released on 16 May 2022. Tomcat 8.5.79 was later released on 23 May. Amongst other changes, all of these versions include a new error message that is shown when the Linux kernel duplicate accept bug is detected. This change follows the identification of the root cause of the bug along with the kernel version that includes the fix.
• OpenResty 1.21.4.1 was released on 18 May 2022. This web platform now uses nginx 1.21.4 mainline as its core and incorporates many other new features, including support for BoringSSL.
• On 3 May 2022, Microsoft announced the general availability of its next-generation WAF (web application firewall) engine on Azure Application Gateway. This makes use of Open Web Application Security Project (OWASP) Core Rule Set 3.2 (CRS 3.2), which is intended to provide increased coverage for web vulnerabilities, reduce false positives, and protect against specific vulnerabilities like Log4J and SpringShell.
• Microsoft has also expanded its Azure Migration and Modernization Program (AMMP) to encourage more customers to move their web applications to Azure. Azure also offers free Extended Security Updates for SQL Server 2012 and Windows Server 2012, giving more time to modernize older applications for three additional years beyond the 10 years granted by Microsoft Support.
• Cloudflare made several new features available during the month of May, including:
  • The ability for everyone to proxy DNS wildcard records. This feature was previously only available to enterprise customers.
  • Cloudflare Pages now support direct uploads.
  • The Cloudflare R2 object storage solution has entered open beta.
  • Cloudflare D1 – an SQL database based on SQLite – was also announced. A demo site that runs on Cloudflare Workers can be seen at https://northwind.d1sql.com/.
  • Cache Reserve provides a new way to persistently serve all static content from Cloudflare’s global cache.
  • Workers Analytics Engine provides a new way to get telemetry about anything that uses Cloudflare Workers.
  • Cloudflare has open sourced a Cloudflare Relay Worker that takes a generic webhook response and delivers it to Rocket Chat.
  • Cloudflare’s Ethereum and IPFS gateways are now publicly available to all Cloudflare customers.
  • Workers for Platforms, Pages Plugins, and Custom Domains for Workers were also announced.

Continue reading

In the April 2022 survey we received responses from 1,160,964,134 sites across 271,960,629 unique domains and 11,974,636 web-facing computers. This reflects a loss of 8.66 million sites and 217,000 domains, but a gain of 97,400 computers.

Amongst the top ten vendors, nginx gained the largest number of domains and computers this month, maintaining its lead in both of these metrics. Its net growth of 537,000 domains has taken its total up to 73.8 million domains and increased its market share in this metric to 27.1%. Coupled with a net loss of 573,000 domains powered by Apache, this has culminated in nginx’s market share lead over Apache being extended from 3.63 percentage points to 4.04.

The number of web-facing computers running nginx grew by 80,200 (+1.78%), pushing its market share up to 38.3% while Apache’s fell to 29.0%. nginx also continues to have the largest market share of sites (31.1%), despite losing more than half a million this month.

Within the top million websites, Cloudflare made the largest gain of 3,350 sites as it continues to edge its way up towards the leaders. Apache is currently still in the lead with 229,000 sites in the top million, but lost 1,700 this month; and nginx is in second place with 218,000 sites after losing 2,250. Cloudflare now has 199,000 sites and looks set to overtake both nginx and Apache by the end of the year if it maintains this pace of growth. Amongst all websites, Cloudflare lost 38,400 sites but gained 115,000 domains.

OpenResty was the major vendor that gained most sites this month, increasing its total by 1.47 million to 93.0 million (+1.61%), and it also gained 6,890 web-facing computers.

While most of the top vendors lost active sites this month, Pepyaka made a significant gain of 1.22 million active sites (+27.6%). This server is predominantly used by the Wix web development platform, which switched from using nginx in 2018. It is currently the 8th most commonly used web server by active sites, and 11th by sites. Similarities in the version numbering since 2018 suggest Pepyaka is likely based on mainline releases of nginx.

Further down the field, GHS gained 1.08 million (+36.7%) sites and 554,000 (+35.5%) domains. GHS (Google Host Server) is one of Google’s proprietary web servers, which can be used by sites registered through Google Domains. It is also still used to redirect traffic from googlepages.com sites that were created with Google Page Creator. When this website creation service shut down in 2009, existing pages were migrated to Google Sites, which hosts user content in subdirectories under the sites.google.com hostname.

Vendor news

• Apache Tomcat 8.5.78, 9.0.62, 10.0.20 and 10.1.0-M14 (alpha) were released on 1 April 2022. Amongst other changes, all of these releases include a mitigation for a Spring Framework vulnerability (CVE-2022-22965) that could make some Tomcat servers vulnerable to remote code execution attacks.
• Tomcat Native 1.2.32 was released on 22 March 2022. This is an optional component for use with Apache Tomcat that can provide better performance and compatibility by allowing Tomcat to use certain native resources.
• njs 0.7.3 was released on 12 April 2022. This is the JavaScript-based scripting language that can be used to extend the functionality of nginx, and the latest version now allows the host environment to control how imported modules are loaded.
• OpenResty 1.21.4.1 RC3 was released on 18 April 20202. This includes some bugfixes and uses a newer version of the LuaJIT 2 compiler.
• Microsoft Azure now offers a bring your own IP address (BYOIP) feature with Custom IP Prefix that lets customers bring their own public IPv4 address ranges to Azure in all public regions. These ranges can then be associated with Azure resources, interact with private addresses and VNETs within Azure’s networks, and reach external destinations via Microsoft’s Wide Area Network.
• Cloudflare’s Magic Transit DDoS mitigation solution now offers a new mode (On Demand + Flow-based Monitoring) that integrates Kentik Protect to automatically detect attacks.
• Finally, have you noticed fewer CAPTCHAs on the web? Cloudflare has reduced the number of CAPTCHAs it serves by 91% over the past year, and now plans to stop using them altogether.

Continue reading

In the March 2022 survey we received responses from 1,169,621,187 sites across 272,177,331 unique domains and 11,877,217 web-facing computers. This reflects a loss of 4.00 million sites, but a gain of 977,000 domains and 103,000 web facing computers.

Cloudflare gained the largest number of sites, with 1.32 million more than in the February survey. Its growth was also consistent across other metrics, having gained +176,000 domains (+0.77%) and +256,000 active sites (+1.24%), with an extra 0.12pp share of the top one million sites.

nginx, the current leader by most metrics, had a particularly strong growth in terms of domains, having gained 978,000 domains (+1.35%) this month—the largest gain of any vendor in this metric. Though it lost 2.98 million sites, it appears to be serving more interesting content overall, as measured by a 158,000 increase in its number active sites. It also gained the most additional web-facing computers out of all vendors this month, with 39,300 more than the previous month. OpenResty, which uses nginx, is serving 62,300 more active sites and now counts towards an additional 441 of the top one million sites. OpenResty was also counted on 6,640 more computers (+5.04%) than last month.

Apache has the greatest number of active sites and, by a narrow 1.03pp margin over nginx, the greatest share of the top one million sites. However, it shrunk in both of these metrics, losing 583,000 active sites and 2,130 of the top one million. Apache lost out in most other metrics too, with 756,000 fewer domains and just over 5 million fewer sites. It did, however, gain a few more computers over last month, but nginx’s large growth meant that Apache still lost market share in this measurement.

Microsoft saw declines in all metrics this month, losing 3.22 million sites (-7.13%), 156,000 domains (-1.75%), 118,000 active sites (-1.88%), and 7,620 computers (-0.57%). Microsoft also lost 1,000 sites from its share of the top million.

Although one of the smaller web servers on the market, LiteSpeed has frequently shown strong and consistent growth, with this month being no exception. It had the largest sites and active sites growth of all web servers in the March 2022 survey, gaining 1.92 million sites and 277,000 active sites.

Vendor news

• Apache released version 2.4.53 of their httpd web server. This version contains security fixes for four different CVEs. The release also brings a number of general bug fixes. Apache also released bug patches for several versions of Tomcat.

• OpenSSL released versions 3.0.2 and 1.1.1n of their cryptography library in order to patch against a high severity denial of service vulnerability. OpenSSL is used by both Apache and nginx, which together account for a majority of all sites, domains, and web-facing computers.

• Microsoft Azure has expanded to a new region in the North of China. Microsoft’s share of the web server software market is much larger in China compared to the rest of the world, with 16.5% of active sites, 20.1% of domains, 13.4% of sites, and 15.0% of web-facing computers.

Continue reading